Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

The insurance sector is in the middle of a cybersecurity storm. In 2024, Indusface analyzed over 495 million attacks targeting insurance websites and APIs. The findings were alarming: attackers are no longer spraying and praying; they’re precise, persistent, and increasingly automated. Here’s what the data showed: Insurance companies, which handle high volumes of personal and financial data, cannot afford security gaps.

Web Application Firewalls (WAFs) play an important role in protecting websites and applications from common threats. But despite their growing adoption, WAFs are often surrounded by myths and misunderstandings that can lead to ineffective implementation or underutilization. In this blog, we debunk the most common myths about WAFs and reveal the truth behind what they can and cannot do.

A Web Application Firewall (WAF) is your first line of defense against internet traffic that can be both legitimate and malicious. It helps protect your web applications, websites, and servers from various cyber-attacks by filtering out harmful traffic. WAF (WAAP) is essential for web security as it quickly identifies and addresses vulnerabilities in applications and servers.

On March 19, 2025, the CISA issued a warning about the active exploitation of CVE-2017-12637, a directory traversal vulnerability in SAP NetWeaver AS Java. This vulnerability, originally patched in 2017, has resurfaced due to incomplete mitigations, leading to increased risks for organizations using outdated or misconfigured SAP environments.

On March 17th, 2025, security researchers confirmed active exploitation of Apache Tomcat’s recently disclosed vulnerability, CVE-2025-24813. Publicly disclosed on March 10th, the earliest signs of exploitation were observed on March 12th, with attackers leveraging the flaw just 30 hours after disclosure. This vulnerability enables Remote Code Execution (RCE) and information disclosure by exploiting Tomcat’s request-handling mechanism.

Choosing the right WAF solution is not just about ticking a checkbox—it’s about ensuring real-time security, threat intelligence, and seamless operations. A poorly chosen WAF can lead to downtime, false positives, compliance gaps, and missed zero-day threats. So, before you commit to a WAF provider, ask these critical questions to ensure your web applications and APIs are protected against evolving cyber threats.